2

I want to migrate active directory accounts from multiple on-premise servers (located on different location and having same domain name) to Office 365.

I am using Azure AD Connect to sync these accounts and I tested by creating a dummy environment (single server). Everything is working fine. Now the thing I want to know is that can I configure Azure AD Connect similarly on all my servers so that account from all servers will be synced on Office 365.

Points to note here:

  1. I don't have any conflict in usernames on my server
  2. I already have email account of users on office 365 and want to merge on-premise and Office 365 account based on username/ email address
  3. I want password synchronization
  4. Enable SSO (Single Sign On) for Office 365 account

My main doubt is about SSO because when I configured Azure AD Connect on my single server dummy environment, it configured SSO so if I will do same thing on all server do I need to do SSO configuration also or I have to leave this step one other servers?

  • 2
    Hi Ankit can you clarify your domain structure? you mention multiple servers, are they all part of the same domain? are they in separate domains? – Michael Brown Jun 28 '17 at 11:43
  • Hi Michael, I have different servers on different locations and all the server have same domain name. – Nikhil Gaur Jun 29 '17 at 3:46
  • Are all the servers part of the same AD Forest? – Michael Brown Jun 29 '17 at 8:11
  • 1
    Alright. You either have the worst Active Directory configuration I've ever even heard about in 15 years as a sysadmin, or you don't know what you're talking about. Either way, I don't see any possible way to help you, based on what you've said. – HopelessN00b Jun 30 '17 at 5:29
  • 1
    You should never have configured them with the same domain names on each of those locations/offices. As per my answer, you can either setup separate AD tenants for each of these locations with UNIQUE domain names or you'll need to completely revamp your design. You simply don't have a supported configuration that O365 can work with. – TheCleaner Jul 5 '17 at 14:33
3

I suggest you read this MS article:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies

Specifically this section:

Single forest, multiple sync servers to one Azure AD tenant

enter image description here

Having multiple Azure AD Connect sync servers connected to the same Azure AD tenant is not supported, except for a staging server. It's unsupported even if these servers are configured to synchronize with a mutually exclusive set of objects. You might have considered this topology if you can't reach all domains in the forest from a single server, or if you want to distribute load across several servers.

You CAN have one or more STAGING servers, but they are only for DR purposes and really aren't even needed short of remembering your configuration/sync settings.

If you export and document your AADConnect settings/mappings/customization then you can just as easily rebuild a new AADConnect server in a DR scenario.

You CANNOT have more than one AADConnect sync server in your environment connecting to the same Azure AD tenant.

  • Hi TheCleaner, so you want to say even if all my server are on different locations (not connected to each other) and having separate set of usersnames but because they have same domain name so it will behave like single forest? – Nikhil Gaur Jun 29 '17 at 4:12
  • 1
    @NikhilGaur - pretty much. You can't have one O365 tenant and multiple AADConnect servers syncing to that instance, even if it were multiple forests. You'd either need multiple O365 tenants federated together, or you'd need to setup a cross-forest trust and let one server on-premise sync everything for both forests up to a single tenant. – TheCleaner Jul 5 '17 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.